There’s no one even close in terms of ssh login attempts. In a span of two weeks, mcblockd has blocked 47 million more addresses from China. That doesn’t mean I’ve seen 47 million IP addresses in login attempts. It means that China has a lot of address space being used to probe U.S. sites.
Brazil is in second place, but they’re behind by more than a decimal order of magnitude. Below are the current top two countries being blocked by mcblockd, by quantity of address space.
% mcblockc getactive ssh_losers
...
Addresses covered per country:
CN 149,911,680
/10 networks: 10 (41,943,040 addresses)
/11 networks: 21 (44,040,192 addresses)
/12 networks: 38 (39,845,888 addresses)
/13 networks: 26 (13,631,488 addresses)
/14 networks: 23 (6,029,312 addresses)
/15 networks: 26 (3,407,872 addresses)
/16 networks: 14 (917,504 addresses)
/17 networks: 4 (131,072 addresses)
/18 networks: 1 (16,384 addresses)
/19 networks: 1 (8,192 addresses)
/21 networks: 2 (4,096 addresses)
/22 networks: 2 (2,048 addresses)
/25 networks: 1 (128 addresses)
BR 14,170,112
/10 networks: 1 (4,194,304 addresses)
/11 networks: 3 (6,291,456 addresses)
/12 networks: 1 (1,048,576 addresses)
/13 networks: 3 (1,572,864 addresses)
/14 networks: 3 (786,432 addresses)
/15 networks: 1 (131,072 addresses)
/17 networks: 2 (65,536 addresses)
/18 networks: 1 (16,384 addresses)
/19 networks: 5 (40,960 addresses)
/20 networks: 2 (8,192 addresses)
/21 networks: 5 (10,240 addresses)
/22 networks: 4 (4,096 addresses)
I seriously doubt that Chinese citizens have anything to do with these attempts. I’m told that the Great Firewall blocks most ssh traffic on port 22. Not to mention that China’s Internet connectivity is somewhere near 95th in the world in terms of available bandwidth, so it’d be terribly painful for an ordinary user to use ssh or scp from China to my gateway. I think I can assume this is all government-sponsored probing.